Re: Laws Outside the U.S.

Germany:

There is no restriction of import or use of cryptography ( _yet_ ). 

There are some restrictions about export and transmission of encrypted data:

- Encryption soft/hardware can not be exported to communist countries
  (COCOM) without problems. I don't know exactly, whether it is
  forbidden, must be licensed, or must be registered in any way.

- There are two kinds of amateur radio, the CB (citizen band) and the
  licensed amateur radio, which requires a personal license. On this
  licensed radio it is not allowed to send encrypted messages, but as
  far as I know nobody cares and nobody checks. The sense was to make
  you use the telephone and pay.

- There was a restriction about the telephone net. You are not allowed
  to transmit anything but voice. I don't know what happened with that
  restriction since everyone uses fax and modem legally. 



At the moment they have a lot of problems with such laws. They have to
decide whether they are valid or not, because most european countries
have joined the European Community. The EC forces their countries to
equalize their laws in the sense of "what you can do in one country,
you can do everywhere".

Sometimes this is very helpfull (e.g. use of modems. Most of them
where illegal in Germany, meanwhile nearly all of them have a
license), sometimes they have silly ideas (e.g. laws about ingredients
of noodles or beer). 

If France forbids the import of crypto software, but allows to sell it
inside of France, then I can sue France, because the french programmer
can sell his programs in France and I can't.

I'm sure we will get a special crypto law within the next years.


Hadmut

Hadmut Danisch writes:

>                                     The EC forces their countries to
> equalize their laws in the sense of "what you can do in one country,
> you can do everywhere".

> If France forbids the import of crypto software, but allows to sell it
> inside of France, then I can sue France, because the french programmer
> can sell his programs in France and I can't.

Isn't it inevitable that this will -- for the same reasons of equity
among the member countries -- evolve into a single set of laws governing
the *use* of crypto throughout the EC?


> I'm sure we will get a special crypto law within the next years.

Can you provide any predictions as to its content?  It seems to me
that the EC may be a *huge* force -- for good or ill -- with respect to
crypto, depending on which way the rules fall out.  In the first place,
because of the sheer size of the EC and the combined power and populace
of its member countries, but also because any internal crypto advantage
the EC is perceived to hold might be an additional spur to liberalization
of US crypto export policy.


-- Jeff

On Sep 21,  1:08pm, Hadmut Danisch wrote:
> - Encryption soft/hardware can not be exported to communist countries
>   (COCOM) without problems. I don't know exactly, whether it is
>   forbidden, must be licensed, or must be registered in any way.

This had an interesting side-effect in the GSM specifications, as there was
a lot of dispute about how secure GSM should be.  As West Germany (as it was
then) had a lot of borders with the Eastern Bloc, they wanted very
strong crypto.  France wanted very weak crypto.  Considering the players
involved, you can imagine the rest.

A5 ended up being based on a French design, so I think we can draw the
obvious conclusions.  Although I have been told that the A5 implementation
available on the network bears little relation to the final one
released in GSM, I believe that the current feeling is that it has
a key entropy of 40 bits maximum, if that.

							Ian.